CVE-2014-3527 Authorization Bypass in Spring Security
A malicious CAS service can bypass access control restrictions in Spring Security when using proxy ticket authentication, allowing unauthorized authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3527?
CVE-2014-3527 is a critical authentication bypass vulnerability in Pivotal Spring Security, published on 25 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed. If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.
Weakness: CWE-287
Which versions are affected by CVE-2014-3527?
4 open source packages ship an affected version, including org.springframework.security:spring-security-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-core Maven | All versions | 3.1.7 |
org.springframework.security:spring-security-core Maven | All versions | 3.1.7 |
org.springframework.security:spring-security-core Maven | From 3.2.0 | 3.2.5 |
org.springframework.security:spring-security-core Maven | From 3.2.0 | 3.2.5 |
Products include Vmware Spring Security.
How do I fix CVE-2014-3527?
Upgrade org.springframework.security:spring-security-core to a fixed version for your release line: 3.1.7 or 3.2.5.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2014-3527 being exploited?
There is no known exploitation of CVE-2014-3527 in the wild and no public exploit code.
Other vulnerabilities in Pivotal Spring Security
- CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata
- CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
- CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written
- CVE-2023-34034 Access Control Bypass in Spring Security
- CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Sources
Also known as GHSA-wmv4-5w76-vp9g.